status?

[warren-bank]

Hi. I also have the ZyXEL c1100z dsl modem/router combo from CenturyLink. I also updated my firmware to the most recent version ( ie: CZW003-4.12.010.16 ) on their website. I am also trying to access a root shell through telnet, but am blocked by a secondary password challenge.

I was wondering what progress you've made?
Have you been able to build and install the firmware from source?
Or, better yet, have you found a less invasive way to obtain the needed password?

If not, would you happen to know the final version of the official firmware that didn't require a password for shell? Assuming no major security issues, I may just decide to revert my firmware to an older version.

The immediate reason for my wanting root access is to inspect whether "kernel IP forwarding" is enabled, and also the "iptables" firewall routing configuration.

The reason for my wanting to do so is that I've configured two subnets through the httpd GUI, and they allow cross-talk. A client in one subnet (ex: 192.168.1.xxx) can connect to a server running in the other (ex: 192.168.2.xxx). For my use-case, this is a major security breach. And I'd like to look around at how the modem is configured and try to fix it.

[bigmac529]

Hello, for what it's worth, I'm also dealing with the same issues as @warren-bank. Has anyone figured this out yet?

Thanks!
-Mike

[SilverMight]

Same question, albeit 1 year later. Any updates?

[warren-bank]

I'm still running CZW003-4.12.010.16.. never found a fix/workaround.

I see that there have been updates:

• v4: CZW004-4.12.010.24
• v5: CZW005-4.16.011.44
• v6: CZW006-4.16.012.0

And it appears that another release will be available very soon:

• v7: CZW007-4.16.012.8

I haven't tested any of these. Question to anyone who has:
Was the sh password challenge removed in any of these newer versions?

[SuperJames888]

5 years late, but I am also trying to find the password. It does still exist on later version sadly. I am on version 7. I actually had some stupid plans for this router.

[SuperJames888]

New update. I have access to it through serial, which is basically like ssh, or telnet, but you can see everything it does. Via interrupting the autoboot, I was able to downgrade the firmware to version CZW001-4.12.008.2. This firmware version has no shell password. While poking around, I was able to see the support console html URL. The issue is that needs a password as well. Seems possible to crack. If anyone wants more information, will provide.

@warren-bank @mcsocha @SilverMight Pinging all of you just in case you still want to do this.

@bwbryant1 Also pinging you since you creating this github repository to find the password.

[warren-bank]

@SuperJames888 wow! You've made some amazing progress. As for myself, I quit CenturyLink DSL when Verizon 5G Home became an option where I live.. so my 2 old C1100Z units are now retired.. to a closet.. somewhere. Never-the-less.. if you don't mind writing up a quick tutorial.. it would surely be a helpful reference to others... who will read this issue long after you've forgotten about your recent efforts.